@desplega.ai/agent-swarm 1.166.0 → 1.168.0

package/dist/{cli-df56tqdw.js → cli-ee0402n1.js}

@@ -20,7 +20,7 @@ import {
 import {
   ensurePricingSeeded,
   ensureRbacSeeded
-} from "./cli-0nhdwxd5.js";
+} from "./cli-43jg9xdw.js";
 import {
   buildCatalogEntries,
   getCatalogGeneration,
@@ -30,10 +30,10 @@ import {
   requestModelCatalogRefresh,
   startPricingRefreshLoop,
   upsertModelCatalogOverlay
-} from "./cli-rggdq8wq.js";
+} from "./cli-9q24yyvs.js";
 import {
   loadModelsDevCache
-} from "./cli-ysnyhws9.js";
+} from "./cli-ewhwpyrb.js";
 import {
   AppDefinitionSchema,
   AppElementsSchema,
@@ -64,6 +64,7 @@ import {
   decodeAppDefinition,
   definitionNodeIds,
   deleteApp,
+  deleteScriptConnection,
   disableCredentialBinding,
   extractArgsJsonSchema,
   extractScriptSignature,
@@ -106,7 +107,7 @@ import {
   validateDefinition,
   validateScriptImports,
   writeBareImportShim
-} from "./cli-jvj6a0cv.js";
+} from "./cli-g6gx2dn1.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
@@ -115,18 +116,18 @@ import {
   registerProcessGroup,
   terminateProcessGroup
 } from "./cli-zt3w1cn1.js";
-import {
-  AgentFsProvider,
-  getFileStorageProvider,
-  providerPath
-} from "./cli-mzfth0bp.js";
 import {
   buildAuthorizationUrl,
   ensureAuthorizationTokenOrThrow,
   ensureToken,
   ensureTokenOrThrow,
   onAuthorizationRefreshed
-} from "./cli-j2jbr8af.js";
+} from "./cli-fhj4y16f.js";
+import {
+  AgentFsProvider,
+  getFileStorageProvider,
+  providerPath
+} from "./cli-mzfth0bp.js";
 import {
   ZodFirstPartyTypeKind,
   objectType
@@ -156,11 +157,11 @@ import {
   taskCitationWarnings,
   upsertTaskCitations,
   withSpan
-} from "./cli-ecknp7p1.js";
+} from "./cli-j05x7pnb.js";
 import {
   getUserGrant,
   init_rbac_roles
-} from "./cli-8kgvmkak.js";
+} from "./cli-0jngabtb.js";
 import {
   can,
   decideAdmission,
@@ -374,6 +375,7 @@ import {
   init_db1 as init_db2,
   init_db_client,
   init_embeddings,
+  init_enabled_tools,
   init_key_paths,
   init_memory,
   init_model_tier_keys,
@@ -424,11 +426,13 @@ import {
   onTaskStarted,
   overwriteTerminalTaskResultText,
   pageContextKey,
+  parseEnabledTools,
   placeholderForConfigKey,
   postMessage,
   promoteDraftTask,
   reassociateSessionLogs,
   recordBudgetRefusalNotification,
+  recordInlineScriptRun,
   recordSlackMessage,
   refreshDraftTaskLease,
   rejectTask,
@@ -486,7 +490,7 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   workflowContextKey
-} from "./cli-yshaazs1.js";
+} from "./cli-74ez9b66.js";
 import {
   $OpenAPIRegistry,
   $OpenApiGeneratorV31,
@@ -555,12 +559,23 @@ import {
   init_task_attachment_links,
   taskAttachmentDisplayUrl,
   taskAttachmentFetchCommand
-} from "./cli-jhm6hzjn.js";
+} from "./cli-mxvnnv5q.js";
 import {
   getSlackConfiguration,
   init_config,
   isSlackConfigured
 } from "./cli-dmtrxqhg.js";
+import {
+  deepInterpolate,
+  findInterpolationTokens,
+  getTemplateDefinition,
+  init_registry,
+  init_resolver,
+  init_template,
+  interpolate,
+  registerTemplate,
+  resolveTemplate
+} from "./cli-5c2j5yvx.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   getAgentFsDefaultDriveId,
@@ -573,17 +588,6 @@ import {
   init_constants,
   isCombEnabled
 } from "./cli-gd4favx9.js";
-import {
-  deepInterpolate,
-  findInterpolationTokens,
-  getTemplateDefinition,
-  init_registry,
-  init_resolver,
-  init_template,
-  interpolate,
-  registerTemplate,
-  resolveTemplate
-} from "./cli-5c2j5yvx.js";
 import {
   init_env_flag,
   isEnvFlagEnabled,
@@ -601,7 +605,7 @@ import {
   modelFamilyKey,
   parseAlias,
   resolveAlias
-} from "./cli-zsh093hk.js";
+} from "./cli-014vns2y.js";
 import {
   exports_zod,
   init_zod
@@ -650,7 +654,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-4r1sjfc4.js";
+} from "./cli-ng1pmdx6.js";
 import {
   init_event_bus,
   workflowEventBus
@@ -14390,7 +14394,7 @@ async function notifyAutomationPreflightFailure(preflight) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-43vrdmv8.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-ffes2kyf.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Automation Preflight] Slack not available, cannot send notification");
@@ -18072,6 +18076,7 @@ var import_cron_parser = __toESM(require_dist2(), 1);
 init_db2();
 init_db();
 init_telemetry();
+init_secret_scrubber();
 
 // src/scheduler/deferred-task-waits.ts
 init_db2();
@@ -18498,18 +18503,64 @@ async function executeScheduleScript(schedule) {
     throw new Error(`Script '${schedule.scriptName}' not found`);
   }
   const agentId = schedule.createdByAgentId ?? "schedule";
-  const output = await runScript({
-    source: script.source,
-    args: schedule.scriptArgs ?? {},
-    fsMode: "none",
+  const args = schedule.scriptArgs ?? {};
+  const record2 = {
     agentId,
-    egressSecrets: await buildScriptCredentialBindings({ agentId }),
-    apiConnections: getScriptApiConnectionDescriptors({ agentId }),
-    mcpConnections: getScriptMcpConnectionDescriptors({ agentId }),
-    timeoutMs: 60000
-  });
+    scriptName: schedule.scriptName,
+    source: `// Scheduled run of '${script.name}' v${script.version} (global, contentHash ${script.contentHash}) by schedule '${schedule.name}'.
+// Full source: script_versions row for this version.
+`,
+    args,
+    startedAt: new Date().toISOString()
+  };
+  let output;
+  try {
+    output = await runScript({
+      source: script.source,
+      args,
+      fsMode: "none",
+      agentId,
+      egressSecrets: await buildScriptCredentialBindings({ agentId }),
+      apiConnections: getScriptApiConnectionDescriptors({ agentId }),
+      mcpConnections: getScriptMcpConnectionDescriptors({ agentId }),
+      timeoutMs: 60000
+    });
+  } catch (err) {
+    await recordScheduleScriptRun({
+      ...record2,
+      status: "failed",
+      error: err instanceof Error ? err.message : String(err)
+    });
+    throw err;
+  }
   if (output.exitCode !== 0 || output.error) {
-    throw new Error(output.stderr || `Script '${schedule.scriptName}' exited with code ${output.exitCode}${output.error ? ` (${output.error})` : ""}`);
+    const message = output.stderr || `Script '${schedule.scriptName}' exited with code ${output.exitCode}${output.error ? ` (${output.error})` : ""}`;
+    await recordScheduleScriptRun({
+      ...record2,
+      status: "failed",
+      output: output.result,
+      error: message
+    });
+    throw new Error(message);
+  }
+  await recordScheduleScriptRun({ ...record2, status: "completed", output: output.result });
+}
+async function recordScheduleScriptRun(run) {
+  try {
+    await recordInlineScriptRun({
+      id: crypto.randomUUID(),
+      agentId: run.agentId,
+      scriptName: run.scriptName,
+      source: run.source,
+      args: scrubObject(run.args),
+      status: run.status,
+      output: scrubObject(run.output),
+      error: run.error === undefined ? undefined : scrubSecrets(run.error),
+      startedAt: run.startedAt,
+      finishedAt: new Date().toISOString()
+    });
+  } catch (err) {
+    console.warn(`[scheduler] could not record script run for '${run.scriptName}': ${scrubSecrets(err instanceof Error ? err.message : String(err))}`);
   }
 }
 
@@ -19971,17 +20022,34 @@ function normalizeObjectSchema(schema) {
   }
   return;
 }
+function getDotPath(path) {
+  if (path.length === 0) {
+    return "object root";
+  }
+  return path.reduce((acc, seg, index) => {
+    if (index === 0) {
+      return String(seg);
+    }
+    if (typeof seg === "number") {
+      return `${acc}[${seg}]`;
+    }
+    return `${acc}.${seg}`;
+  }, "");
+}
 function getParseErrorMessage(error) {
   if (error && typeof error === "object") {
+    if ("issues" in error && Array.isArray(error.issues) && error.issues.length > 0) {
+      return error.issues.map((i) => {
+        if (!i.path?.length) {
+          return i.message;
+        }
+        return `${i.message} at ${getDotPath(i.path)}`;
+      }).join(`
+`);
+    }
     if ("message" in error && typeof error.message === "string") {
       return error.message;
     }
-    if ("issues" in error && Array.isArray(error.issues) && error.issues.length > 0) {
-      const firstIssue = error.issues[0];
-      if (firstIssue && typeof firstIssue === "object" && "message" in firstIssue) {
-        return String(firstIssue.message);
-      }
-    }
     try {
       return JSON.stringify(error);
     } catch {
@@ -23206,16 +23274,7 @@ class Server extends Protocol {
     if (!methodSchema) {
       throw new Error("Schema is missing a method literal");
     }
-    let methodValue;
-    if (isZ4Schema(methodSchema)) {
-      const v4Schema = methodSchema;
-      const v4Def = v4Schema._zod?.def;
-      methodValue = v4Def?.value ?? v4Schema.value;
-    } else {
-      const v3Schema = methodSchema;
-      const legacyDef = v3Schema._def;
-      methodValue = legacyDef?.value ?? v3Schema.value;
-    }
+    const methodValue = getLiteralValue(methodSchema);
     if (typeof methodValue !== "string") {
       throw new Error("Schema method literal must be a string");
     }
@@ -29170,7 +29229,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-43vrdmv8.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-ffes2kyf.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -29241,7 +29300,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient: getDbClient2 } = await import("./db-sjks418k.js");
+  const { getDbClient: getDbClient2 } = await import("./db-1t0bj3pc.js");
   await getDbClient2().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -103046,7 +103105,7 @@ async function reloadGlobalConfigsAndIntegrations() {
   return runWithoutRequestAuth(() => reloadGlobalConfigsAndIntegrationsInner());
 }
 async function reloadGlobalConfigsAndIntegrationsInner() {
-  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-9b65j1m5.js");
+  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-gr69c43q.js");
   const wasEmbeddingsConfigured = getEmbeddingProvider2().isConfigured();
   const updated = await loadGlobalConfigsIntoEnv(true);
   await stopSlackApp();
@@ -103059,10 +103118,10 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
     integrations.push("embeddings");
   }
   if (!wasEmbeddingsConfigured && isEmbeddingsConfigured) {
-    import("./boot-reembed-s7k7c6v2.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+    import("./boot-reembed-jvfadhsk.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
       console.error("[config-reload] memory backfill failed (non-fatal):", err);
     });
-    import("./boot-reembed-998jtpdg.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+    import("./boot-reembed-20q3nzvg.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
       console.error("[config-reload] script backfill failed (non-fatal):", err);
     });
   }
@@ -104180,7 +104239,7 @@ function setPreloadedTools(server, names) {
 async function applyPreToolCall(name, args, requestInfo, inputSchema) {
   if (requestInfo.callOrigin !== "mcp")
     return { args };
-  const dispatcher = await import("./dispatcher-1es759rn.js");
+  const dispatcher = await import("./dispatcher-k1fhavcf.js");
   const result = await dispatcher.dispatchPre("pre.tool.call", { tool: name, args, requestInfo }, inputSchema ? {
     validateModify: async (data) => {
       const schema = normalizeObjectSchema(inputSchema) ?? inputSchema;
@@ -117024,7 +117083,7 @@ var QuestionSchema = object({
   type: _enum(["approval", "text", "single-select", "multi-select", "boolean"]).describe("Question type"),
   label: string().describe("The question text displayed to the user"),
   required: boolean().optional().describe("Whether this question is required (default: true)"),
-  description: string().optional().describe("Optional help text"),
+  description: string().optional().describe("Optional help text, rendered as markdown (code fences, images)"),
   placeholder: string().optional().describe("Placeholder text (for text type)"),
   multiline: boolean().optional().describe("Use textarea instead of input (for text type)"),
   options: array(object({
@@ -117040,7 +117099,7 @@ var registerRequestHumanInputTool = (server) => {
   createToolRegistrar(server)("request-human-input", {
     title: "Request human input",
     annotations: { destructiveHint: false },
-    description: "Create an approval request and return at once with the request id and URL. The answer arrives later as a hitl-follow-up task. " + "Supports multiple question types: approval (yes/no), text, single-select, " + "multi-select, and boolean. Returns the request ID and URL for the human to respond.",
+    description: "Create an approval request and return at once with the request id and URL. The answer arrives later as a hitl-follow-up task. " + "Supports multiple question types: approval (yes/no), text, single-select, " + "multi-select, and boolean. Returns the request ID and URL for the human to respond. " + "The dashboard renders each label and description as markdown: put long content in description, fence code with a language, and put an image URL alone on its own line to show it. " + "No Slack message is sent; share the URL yourself.",
     inputSchema: object({
       title: string().min(1).describe("Title of the approval request"),
       questions: array(QuestionSchema).min(1).describe("Questions to ask the human"),
@@ -125151,8 +125210,16 @@ init_zod();
 init_db2();
 init_rbac();
 var scriptConnectionsInputSchema = object({
-  action: _enum(["list", "upsert-openapi", "upsert-mcp", "upsert-graphql", "refresh", "disable"]).describe("List, create/update, refresh, or disable a script connection."),
-  id: string().uuid().optional().describe("Existing connection ID for update, refresh, or disable."),
+  action: _enum([
+    "list",
+    "upsert-openapi",
+    "upsert-mcp",
+    "upsert-graphql",
+    "refresh",
+    "disable",
+    "delete"
+  ]).describe("List, create/update, refresh, disable, or delete a script connection. delete is permanent: it removes the connection, its managed credential binding, and any inline secret it owns."),
+  id: string().uuid().optional().describe("Existing connection ID for update, refresh, disable, or delete."),
   slug: string().min(1).max(80).optional().describe("Stable script namespace slug exposed under ctx.api or ctx.mcp."),
   displayName: string().max(160).optional().describe("Human-readable connection name."),
   scope: _enum(["global", "agent", "repo"]).optional().describe("Connection visibility scope."),
@@ -125241,6 +125308,26 @@ var registerScriptConnectionsTool = (server) => {
         data: { yourAgentId: requestInfo.agentId, connections: connections2 }
       });
     }
+    if (args2.action === "delete") {
+      if (!args2.id) {
+        return toolErr("id is required for delete.", {
+          data: {
+            yourAgentId: requestInfo.agentId,
+            connections: listScriptConnections({ includeDisabled: true, allScopes: true })
+          }
+        });
+      }
+      const deleted = await deleteScriptConnection(args2.id);
+      const connections2 = listScriptConnections({ includeDisabled: true, allScopes: true });
+      if (!deleted) {
+        return toolErr(`Script connection ${args2.id} not found.`, {
+          data: { yourAgentId: requestInfo.agentId, connections: connections2 }
+        });
+      }
+      return toolOk(`Script connection ${deleted.slug} deleted.`, {
+        data: { yourAgentId: requestInfo.agentId, connections: connections2 }
+      });
+    }
     if (args2.action === "refresh") {
       if (!args2.id) {
         return toolErr("id is required for refresh.", {
@@ -125936,7 +126023,7 @@ async function sendTaskHandler(ctx, {
       data: { yourAgentId: creatorAgentId }
     });
   }
-  if (ctx.kind === "owner" && requestedAgentId === ctx.agentId) {
+  if (ctx.kind === "owner" && requestedAgentId === ctx.agentId && ctx.requestInfo?.callOrigin !== "script-sdk") {
     return toolErr("Cannot send a task to yourself, are you drunk?", {
       data: { yourAgentId: ctx.agentId }
     });
@@ -131695,6 +131782,9 @@ var registerUpdateWorkflowTool = (server) => {
     }
   });
 };
+// src/server.ts
+init_enabled_tools();
+
 // src/utils/scripts-only-mode.ts
 init_env_flag();
 function resolveScriptsOnlyMode(opts) {
@@ -131759,9 +131849,43 @@ function getEnabledCapabilities() {
 function isScriptsOnlyMcp() {
   return resolveScriptsOnlyMode({ env: process.env.SCRIPTS_ONLY_MCP });
 }
+var loggedToolAllowlistWarnings = new Set;
+function warnToolAllowlistOnce(message) {
+  if (loggedToolAllowlistWarnings.has(message))
+    return;
+  loggedToolAllowlistWarnings.add(message);
+  console.warn(message);
+}
+function resolveToolAllowlist(value) {
+  if (value === undefined)
+    return;
+  try {
+    const tools = parseEnabledTools(value);
+    if (!tools) {
+      warnToolAllowlistOnce("[MCP] SWARM_ENABLED_TOOLS is set but lists no tools; ignoring it");
+    }
+    return tools;
+  } catch {
+    warnToolAllowlistOnce("[MCP] Invalid SWARM_ENABLED_TOOLS; ignoring it");
+    return;
+  }
+}
+function applyToolAllowlist(server, allowlist) {
+  const tools = server._registeredTools;
+  const allowed = new Set(allowlist);
+  for (const [name, tool] of Object.entries(tools)) {
+    if (!allowed.has(name))
+      tool.remove();
+  }
+  const unknown3 = allowlist.filter((name) => !Object.hasOwn(tools, name));
+  if (unknown3.length > 0) {
+    warnToolAllowlistOnce(`[MCP] SWARM_ENABLED_TOOLS names unknown tools, ignoring them: ${unknown3.join(", ")}`);
+  }
+}
 async function createServer(opts = {}) {
   await loadGlobalConfigsIntoEnv(true);
-  const hasCapability2 = (cap) => opts.fullSurface === true || getCapabilities().has(cap);
+  const toolAllowlist = opts.fullSurface === true ? undefined : resolveToolAllowlist(opts.enabledTools ?? process.env.SWARM_ENABLED_TOOLS);
+  const hasCapability2 = (cap) => opts.fullSurface === true || toolAllowlist !== undefined || getCapabilities().has(cap);
   initDb(process.env.DATABASE_PATH);
   ensurePricingSeeded();
   startPricingRefreshLoop();
@@ -131785,7 +131909,7 @@ async function createServer(opts = {}) {
   });
   if (opts.preloadedTools?.length)
     setPreloadedTools(server, opts.preloadedTools);
-  if (opts.scriptsOnly ?? isScriptsOnlyMcp()) {
+  if (toolAllowlist === undefined && (opts.scriptsOnly ?? isScriptsOnlyMcp())) {
     registerScriptSearchTool(server);
     registerScriptRunTool(server);
     registerScriptUpsertTool(server);
@@ -131996,6 +132120,8 @@ async function createServer(opts = {}) {
     registerListServicesTool(server);
     registerUpdateServiceStatusTool(server);
   }
+  if (toolAllowlist)
+    applyToolAllowlist(server, toolAllowlist);
   return server;
 }
 
@@ -134561,7 +134687,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp: getSlackApp2 } = await import("./app-43vrdmv8.js");
+        const { getSlackApp: getSlackApp2 } = await import("./app-ffes2kyf.js");
         const app = getSlackApp2();
         if (!app) {
           return {
@@ -134691,7 +134817,8 @@ async function executeRawLlm(config) {
     modelName = llmConfig.model;
     const provider = createOpenAI({
       baseURL: llmConfig.baseURL,
-      apiKey: llmConfig.apiKey
+      apiKey: llmConfig.apiKey,
+      headers: llmConfig.headers
     });
     const model = provider(llmConfig.model);
     if (config.schema) {
@@ -135152,7 +135279,8 @@ class ValidateExecutor extends BaseExecutor {
       const llmConfig = await resolveWorkflowLlmConfig();
       const provider = createOpenAI({
         baseURL: llmConfig.baseURL,
-        apiKey: llmConfig.apiKey
+        apiKey: llmConfig.apiKey,
+        headers: llmConfig.headers
       });
       const { object: object4 } = await generateObject({
         model: provider(llmConfig.model),

package/dist/{cli-mwegs4af.js → cli-ew0c3a1j.js}

@@ -5,10 +5,10 @@ import {
   CONTEXT_FORMULA,
   clampContextPercent,
   computeContextUsedUnified
-} from "./cli-32bca7nr.js";
+} from "./cli-7avy4v8w.js";
 import {
   applyReasoningEffort
-} from "./cli-ttbsse3f.js";
+} from "./cli-tmhsxhb8.js";
 import {
   ampBillsCacheWrites,
   resolveAmpModel
@@ -36,7 +36,7 @@ import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 init_secret_scrubber();
-var AMP_PACKAGE = "@ampcode/cli@0.0.1791403257-g05ffa9";
+var AMP_PACKAGE = "@ampcode/cli@0.0.1791547250-gb79b2a";
 var AMP_MCP_SERVER_NAME = "agent-swarm";
 var AMP_PLUGIN_MODE_KEY = "agent-swarm";
 var AMP_LIVE_TEST_TIMEOUT_MS = 5000;